Cyber Security Act of 2009

Let's talk a bit about this act. Link: http://thomas.loc.gov/cgi-bin/query/z?c111:S.773:

But specifically this part :

S.773

Cybersecurity Act of 2009 (Introduced in Senate)

---

SEC. 17. AUTHENTICATION AND CIVIL LIBERTIES REPORT.

Within 1 year after the date of enactment of this Act, the President, or the President's designee, shall review, and report to Congress, on the feasibility of an identity management and authentication program, with the appropriate civil liberties and privacy protections, for government and critical infrastructure information systems and networks.

SEC. 18. CYBERSECURITY RESPONSIBILITIES AND AUTHORITY.

The President--

(1) within 1 year after the date of enactment of this Act, shall develop and implement a comprehensive national cybersecurity strategy, which shall include--

(A) a long-term vision of the Nation's cybersecurity future; and

(B) a plan that encompasses all aspects of national security, including the participation of the private sector, including critical infrastructure operators and managers;

(2) may declare a cybersecurity emergency and order the limitation or shutdown of Internet traffic to and from any compromised Federal Government or United States critical infrastructure information system or network;

(3) shall designate an agency to be responsible for coordinating the response and restoration of any Federal Government or United States critical infrastructure information system or network affected by a cybersecurity emergency declaration under paragraph (2);

(4) shall, through the appropriate department or agency, review equipment that would be needed after a cybersecurity attack and develop a strategy for the acquisition, storage, and periodic replacement of such equipment;

(5) shall direct the periodic mapping of Federal Government and United States critical infrastructure information systems or networks, and shall develop metrics to measure the effectiveness of the mapping process;

(6) may order the disconnection of any Federal Government or United States critical infrastructure information systems or networks in the interest of national security;

(7) shall, through the Office of Science and Technology Policy, direct an annual review of all Federal cyber technology research and development investments;

(8) may delegate original classification authority to the appropriate Federal official for the purposes of improving the Nation's cybersecurity posture;

(9) shall, through the appropriate department or agency, promulgate rules for Federal professional responsibilities regarding cybersecurity, and shall provide to the Congress an annual report on Federal agency compliance with those rules;

(10) shall withhold additional compensation, direct corrective action for Federal personnel, or terminate a Federal contract in violation of Federal rules, and shall report any such action to the Congress in an unclassified format within 48 hours after taking any such action; and

(11) shall notify the Congress within 48 hours after providing a cyber-related certification of legality to a United States person.

Notice the phrase "Federal Government or United States critical infrastructure information system or network." This broad stroke line brings the following to task ... ANY system tied to the internet is part of the "UNITED STATES CRITICAL INFRASTRUCTURE". By design (and Federal mandate) all telecom systems are interlinked for various reasons this is a necessary event. However, until this legislation these interconnects are managed by seperate competing companies that simply agree to work jointly in providing an agreed level of service all with in the guidelines established and regulated by the FCC. So this infrastructure is already Federally regulated so where is there a need to create an additional agency? Additionally, since there is already regulation in place which states in the event of a national emergency how these private firms must operate. Why should the president have additional new powers?

Flatly this legislation is so broad in scope, context, and scale that it the conclusion of this proposal reminds many of Orwell's "1984". It is interesting that this legislation comes out the same week the Supreme Court rules on what is an illegal search of a person's vehicle during a traffic stop when this legislation allows illegal search of everything electronic ... which in this day and age is EVERYTHING. If you carry a smartphone it is part of "critical infrastructure" as defined by the FCC. Same with home computers, TV's connected via cable, laptops via wifi and every corporate, banking or commercial server.

Please read the whole proposed act at : http://thomas.loc.gov/cgi-bin/query/z?c111:S.773: